This copy is for your personal non-commercial use only. To order presentation-ready copies of Toronto Star content for distribution to colleagues, clients or customers, or inquire about permissions/licensing, please go to: www.TorontoStarReprints.com

Facebook suspends analytics firm on concerns about sharing of public user-data

By Kirsten GrindThe Wall Street Journal

Sat., July 21, 2018

Facebook Inc. suspended another company that harvested data from its site and said it was investigating whether the analytics firm’s contracts with the U.S. government and a Russian non-profit tied to the Kremlin violate the platform’s policies.

Crimson Hexagon, based in Boston, has had contracts in recent years to analyze public Facebook data for those and other clients, according to people familiar with the matter and federal procurement data. Crimson Hexagon says it has the largest repository of public social media posts, totalling more than one trillion, from sites that also include Twitter Inc. and Instagram.

Signage and photographs at the office of Facebook’s Instagram in New York. On Friday, Facebook said it was suspending Crimson Hexagon’s apps from Facebook and its Instagram unit (Jeenah Moon/Bloomberg News)

Crimson Hexagon operates with little oversight from Facebook once it pulls public data from the social-media platform, according to more than a dozen people familiar with the business. The government contracts weren’t approved by Facebook in advance, for example, the people said.

Facebook, in response to questions from The Wall Street Journal this week about its oversight of Crimson Hexagon’s government contracts and storing of user data, said Friday it wasn’t aware of some of the contracts. On Friday, it said it was suspending Crimson Hexagon’s apps from Facebook and its Instagram unit, and launching a broad inquiry into how Crimson Hexagon collects, shares and stores user data.

A spokesman said Facebook plans to meet with Crimson Hexagon’s team within the next several days to look into the matter.

Article Continued Below

“Facebook has a responsibility to help protect people’s information, which is one of the reasons why we have tightened” access to user data in many ways in recent years, said Ime Archibong, Facebook vice president for product partnerships, in a statement.

He said in the statement that Facebook allows outside parties to produce “anonymized insights for business purposes.” Facebook prohibits the use of its data for surveillance purposes.

Chris Bingham, Crimson Hexagon’s chief technology officer, said in a statement earlier this week that it abides by the policies of its social-media partners and the company doesn’t collect private data. On Friday, Mr. Bingham said it is fully co-operating with Facebook and “working together to resolve the issue as quickly as possible.”

Crimson Hexagon pulls only publicly-available data from Facebook and Twitter. However, it appears at least once to have mistakenly received private data from Instagram, according to people familiar with the matter.

In that incident, in 2016, Crimson Hexagon received some private Instagram posts in a batch of hundreds of public posts, because of what Crimson Hexagon employees assumed was a software glitch on Facebook’s part, according to the people familiar with the matter. Crimson Hexagon employees weren’t sure whom to call when the incident occurred as they didn’t have a direct contact at Instagram or Facebook at the time, these people said.

Such fumbles are considered serious because of Facebook’s strict rules against third parties accessing private data.

A spokesman for Facebook said the company had requested further evidence from Crimson Hexagon but, “based on our investigation to date, Crimson Hexagon did not obtain any Facebook or Instagram information inappropriately.”

Article Continued Below

In recent months, Facebook and Chief Executive Mark Zuckerberg have made repeated pledges to become more trusted custodians of user information. Those efforts largely followed the revelation in March that Cambridge Analytica, a research firm with ties to President Donald Trump’s election campaign, had improperly accessed data on millions of Facebook users.

Crimson Hexagon handles large volumes of public user data that the social-media platforms generate daily, including much of the content on Twitter and Instagram and any items on Facebook that users haven’t designated as private. Facebook users can choose how much of their profiles to keep public; names and profile pictures are considered public for all users. Public posts include comments users make on public pages for brands, celebrities or specific events.

Public data, used in bulk, can tell companies how certain groups of people are feeling at a particular time and location, for example — invaluable information for government agencies in the U.S. and abroad, as well as for political parties working to sway voters. Privacy experts say most Americans aren’t aware that public data is analyzed and deployed for so many purposes.

While Facebook doesn’t sell its data, social-media analytics firms like Crimson Hexagon must register as a developer with Facebook and agree to its terms of service before pulling large numbers of posts through a special software portal. Facebook’s terms of service include: “Don’t confuse, deceive, defraud, mislead, spam or surprise anyone.”

With Twitter, Crimson Hexagon and other companies pay for access to large volumes of public data through Twitter’s “fire hose.” Because of restrictions on Facebook’s data, Crimson Hexagon has been able to access more data from Twitter than Facebook, according to some of the people familiar with the matter.

A Twitter spokesman said, “We have invested heavily in our data compliance program over the last several years and we rigorously enforce our rules against violating developers — up to and including permanent suspension of access to Twitter data in any form.”

Crimson Hexagon is one of the largest players in a marketing analytics industry that has grown to more than $1 billion in recent years, according to the research company Gartner Inc.

Gary King, a social scientist and Harvard professor, co-founded Crimson Hexagon in 2007 and serves as chairman. He said in a statement that he has never been involved in the firm’s day-to-day operations.

Earlier this month, Mr. King in his capacity as an academic announced the launch of a new research project that he and Facebook officials have promoted as a reflection of the firm’s renewed commitment to transparency. Called Social Science One, it will give a team of outside researchers access to Facebook data with the goal of better understanding how the platform influences elections and democracy. The project isn’t affiliated with Crimson Hexagon.

Crimson Hexagon has sold its proprietary analytics platform in foreign countries including Russia and Turkey. In 2014, it worked with Civil Society Development Foundation, a Russian non-profit with ties to the government there, according to people familiar with the matter.

The non-profit used Crimson Hexagon’s platform to study the Russian people’s opinion of the regime of Russian President Vladimir Putin, according to a 2015 report by the group. The non-profit didn’t respond to requests for comment.

The government of Turkey used Crimson Hexagon’s service in its decision in 2014 to briefly shut down Twitter amid public dissent, people familiar with the matter said. A Turkish government official declined to comment.

Since 2014, U.S. government agencies have paid Crimson Hexagon more than $800,000 for 22 separate contracts, according to federal procurement data. In June, the firm secured a more than $240,000 contract with the U.S. State Department.

A State Department spokeswoman said one of its divisions uses Crimson Hexagon “to identify and analyze trends in publicly available social and digital media data.” The Defense Department didn’t return a request for comment.

At one point in the past three years, Crimson Hexagon was in talks with the Defense Department to help track Islamic State, according to a person familiar with the matter. Nothing came of the discussion, the person said.

Crimson Hexagon hasn’t broadly publicized its government work, and some employees were initially resistant to pursue those contracts, people familiar with the matter said. Sometimes employees weren’t sure how the government agencies would use the service, the people said.

Twitter appears to have applied more scrutiny than Facebook on Crimson Hexagon’s U.S. government contracts.

In one instance around late 2016, Crimson Hexagon was in talks with U.S. Immigration and Customs Enforcement but dropped out of a potential deal because of Twitter’s resistance, people familiar with the matter said. Twitter ultimately told Crimson Hexagon that it couldn’t sell to any agencies under the Department of Homeland Security because it was too hard to track how the data was being used, the people said.

Public records show Crimson Hexagon has worked with the Department of Homeland Security, including an August 2017 contract with the Federal Emergency Management Agency that will last until Sept. 1.

A FEMA spokeswoman said the agency uses Crimson Hexagon “to understand the volume of discussion and top topics regarding online mentions of FEMA or active disaster responses.” A spokesman for ICE declined to comment.

Crimson Hexagon also contracted with the Secret Service, also part of Homeland Security, between 2014 and 2016. A Secret Service spokeswoman said the agency’s office of government and public affairs used Crimson Hexagon’s tools to track its social-media posts and guide outreach with the media.

More from The Star & Partners

LOADING

Copyright owned or licensed by Toronto Star Newspapers Limited. All rights reserved. Republication or distribution of this content is expressly prohibited without the prior written consent of Toronto Star Newspapers Limited and/or its licensors. To order copies of Toronto Star articles, please go to: www.TorontoStarReprints.com